Sophos Firewall: v19.0 MR1: Feedback and experiences

Hi,

I received an email about 10 minutes ago, it has a number of attachments which are all blank, further the email does not show in logviewer -> email. There a e two entries at the time of the email with no details and show possible spam.

Ian

Further to the message above, I sent the originator a question about the attachment and he advised other recipient were able to view it. I took the iPhone out of the wifi and was able to see the attachment which is an mp4 file.. So something is broken in the latest mail functions in v19.0.1.

I have not made any changes to my mail settings, least of all have the ability to hide messages from XG log viewer -> email report. I have received other messages which do not show up in log viewer. This is an issue that was fixed a couple of versions ago.

Ian

Ian

Unbelievable. Nobody tests the antispam function, with all the problems that have been reported for several months?
We will still be told that it is our fault, and that we must use Sophos Central Email ...

"Several months" is still an understatement. Sophos switched UTM to SASI in June 2021, and since then they have had exactly the same problems with low detection rate, but they switched XG anyway in march 2022. No proper testing before release and Toni never tires of touting Central Email as the alternative, saying how stupid it is to run email protection on a firewall, yet that's exactly how Sophos sells it to its customers. You can't get rid of the feeling that this whole action is only meant to drive customers to Central Email.

Do you have a Bug ID or support ID for UTM as well? I do not recall any major issues with UTM movement to SASI. 

SFOS started with some issues with the Engine itself, but it should run nowadays and give a proper insight in the emails.

SASI is a old engine, Sophos has it for over 15 years. So all products are now using this Engine (Pure Message, Email Appliance, Central Email, UTM, SFOS). 

And Central Email is the superior product in any means, if your concern is security, not only Spam. 

Bug ID? No. Instead I have customers that complain about getting much more spam since the engine change and as a XG home user I can just confirm exactly that. UTM has much more options to fight spam, therefore the poor detection rate can be partly compensated with work for the admins while XG is just left with nothing. You can't even use a simple word filter, it's just a big dissapointment. Thanks to SASI, mail protection on XG is even worse than before, though I havent thought that was even possible.

A superior product at a much higher cost, keep that in mind when your mail protection customers start to migrate to your competition.

Do you have a support case for this customer? 

No, and I don't see why I even should open a case anyway? Did you change anything to improve the spam detection rate and therefore think that the bad detection rate us and our customers experiencing is a bug? If you didn't, then the only thing opening a case with you guys does is stealing a lot of my time, like on almost every case I ever opened with you before.

I'm going to open a case next week after seeing that 19.0 MR1 is still bad compared to 18.5 MR2, which I have absolutely no doubt about, as the way you answered me before shows me that no one at Sophos even acknowledges that there is indeed a massive problem with the spam detection rate. I'm pretty sure that is going to be "nice". Me doing your work, me being your beta-tester, me getting angry since you won't change anything, me giving you support access for many days, just to see nobody even connected to the appliance at all. Yeah, it's going to be a lot of "fun", as always with you guys.

After you create the Case, feel free to post your Case ID to this thread, so we can looking into this particular case. 

After you create the Case, feel free to post your Case ID to this thread, so we can looking into this particular case. 

Oh I will, you can count on me.

Spam detection on 19.0 MR1 seems to work as expected, meaning it's as bad as with 18.5 MR4. I've checked the timeframe since I've upgraded from 18.5 MR2 to 19.0 MR1 and compared it to the last days.

considered period is 19:30-10:30 each.

18.5 MR2
24.07.-25.07. -> 30 spam mails detected
25.07.-26.07. -> 23 spam mails detected
26.07.-27.07. -> 37 spam mails detected

19.0 MR1
27.07.-28.07. -> 6 spam mails detected

Wow. Seems like I don't even need to wait one week to open a case, good work Sophos, good work.

Here you go: 05553951

Hi Dreamcatcher, thank you for sharing your case ID. Please allow me to follow up with our engineering and development team and I will post any updates on this thread as we know more.

Hey Karlos, sure, do as you like.

I checked the last day and compared it to the last full day with 18.5 MR2 running, here are the results:

My customer already got back to me, saying that since the update much more spam is going through. This is not funny by any means!

Just for my interest. Which SASI Version does the customer currently use? 

2022-08-02.11:40:15 MESSAGE [Main] [ precompile.cpp:583] Downloaded file /sdisk/sasi/asdb.delta is verified with checksum..
2022-08-02.11:40:17 MESSAGE [Main] [ engine.cpp:845] Database loaded of version: 2022.8.2.91519
2022-08-02.11:40:17 MESSAGE [Main] [ precompile.cpp:761] [Precompile thread]: Signatures are reloaded with latest delta and verified with checksum
of new signatures.

That is my latest version (extracted by /log/sasi.log). 

Here you go:

2022-08-02.11:40:20 MESSAGE    [Main] [          precompile.cpp:583] Downloaded file /sdisk/sasi/asdb.delta is verified with checksum..
2022-08-02.11:40:23 MESSAGE    [Main] [              engine.cpp:845] Database loaded of version: 2022.8.2.91519
2022-08-02.11:40:23 MESSAGE    [Main] [          precompile.cpp:761] [Precompile thread]: Signatures are reloaded with latest delta and verified with checksum of new signatures.

Update.

Hi, 

For me it looks like this :(

19.0 MR1